Power Platform Community Forum Thread Details

I am building an integration where an external application needs to trigger a Power Automate cloud flow via the "When an HTTP request is received" trigger.

The flow works correctly when invoked manually, and I have the generated HTTP endpoint URL.

The external application team is configuring a Microsoft Entra ID App Registration and has asked for the following information:

Redirect URL (Redirect URI)

Audience / Resource URI

Application ID URI

Tenant-related authentication details

I am trying to understand how Power Automate HTTP-triggered flows are intended to be secured using Microsoft Entra ID authentication.

My questions are:

What is the recommended authentication model for an external application calling a Power Automate HTTP-triggered flow?

Should OAuth 2.0 Authorization Code Flow or Client Credentials Flow be used?

If Authorization Code Flow is used, where can the Redirect URI be obtained?

Does the Power Automate HTTP trigger expose an Audience/Resource URI that should be used during Entra ID app registration?

Is there Microsoft documentation showing the complete Entra ID configuration required for an external application to securely invoke a Power Automate HTTP endpoint?

I am specifically looking for guidance on the Entra ID configuration and OAuth setup required to authenticate calls to a Power Automate HTTP trigger.

Thanks in advance.

Farhad

ps: the attachment is null

New PDF Document.pdf

Categories:

Building flows

For your external application, don't create a Redirect URI unless you actually need an interactive user login. For a background/server integration, start with OAuth 2.0 Client Credentials.

Most importantly, don't invent the Audience/Application ID URI. The resource/API that validates the access token must define the expected audience. If the Power Automate HTTP trigger configuration in your environment doesn't expose a supported way to configure/validate an Entra audience, introduce API Management/Azure Function as the secured API façade and let that layer authenticate the external application before invoking the flow.

Refer:

https://learn.microsoft.com/en-us/entra/architecture/auth-oauth2